9 ms·

Ransomware Spreading onto Smart TVs, Is a Pain to Fix

114 points by kogir 10y ago

acd 10y ago
Smart tv should have open boot loaders allowing open operating systems and then this would not be an issue. There should also be a http boot firmware recovery option. Open operating systems can receive security updates by the community long after the manufacturer has lost their interest in the device. Should it even be called a "Smart TV" if its hard to recover?
- untog 10y ago
  IMO, smart TVs shouldn't exist. You should buy a dumb TV then plug in whatever Chromecast, Roku, Amazon, Apple you want into it. Coupling the two together just means the software gets outdated long before the hardware does. Up until now I haven't really cared, since I ignore all the smart TV junk and use my device anyway. But if it's going to start getting ransomwared no matter what I do... just let me buy a dumb TV.
  - macjohnmcc 10y ago
    We bought a Sharp Roku TV because of price and regret it. I don't care for a TV that has to boot up or have software updates. A dumb monitor even without a tv tuner would be better.
  - angry-hacker 10y ago
    What stops you not connecting the device to network in the first place? Serious question, I haven't bought one yet but probably soon have, because there's no other choice.
    - izacus 10y ago
      Well, just like for many modern phone OSes (e.g. iOS for example in some cases), you're not able to finish the setup wizard and start using it without connecting it to the internet for inital activation.
      - teacup50 10y ago
        What manufacturers require internet activation? That's a non-starter for any product I purchase.
        izacus 10y ago
        I've seen a single Samsung TV up until now, but it was a rather non-common model. Luckly (FOR NOW!) vast majority of TVs still work offline. In the future this may change - at this point some Samsungs already overlay their ads on volume change UI (and some other parts) to get additional revenue. With such incentives, I'm worried just how long you'll be able to buy a TV that can function offline.
  - PaulHoule 10y ago
    It seems like an awful neat solution to me to plug the TV into the ethernet and there you go... If you look at low end TVs you'll find the "useful life" limited more by the hardware than by the software. If the hardware can't do it, for instance, no H.265 decoding for you.
    - izacus 10y ago
      Then again, pretty much all 5 year TVs or so will easily handle H.264 in their supported panel resolution. Which doesn't help you if your Netflix / YouTube app was never updated and can't connect to the service anymore. H.265 is generally only used for 4K content and 4K TVs carry decoders with them mostly.
  - Animats 10y ago
    LG procedure from YouTube video to revert to factory defaults: Plug in. Press Settings + CH Dwn together, release. Select "Wipe data," then "Yes." Wait for "complete." Power cycle. It's not that it's hard, it's that it wasn't in the manual.
- nothrabannosir 10y ago
  > Smart tv should have open boot loaders allowing open operating systems and then this would not be an issue. There should also be a http boot firmware recovery option. Yes > Open operating systems can receive security updates by the community long after the manufacturer has lost their interest in the device. Yes > Should it even be called a "Smart TV" if its hard to recover? ...? Yes.
- jaclaz 10y ago
  There are some alternative firmware projects like samygo (for Samsung) and openlgtv (for LG): https://wiki.samygo.tv/index.php5?title=Main_Page https://wiki.samygo.tv/index.php5?title=Main_Page http://openlgtv.org.ru/wiki/index.php/Main_Page http://openlgtv.org.ru/wiki/index.php/Main_Page But they support AFAIK only a limited number of devices and also only some firmware versions (it seems like both Samsung and LG are attempting to close the doors).
walterbell 10y ago
Buy a short-throw projector and connect an easily upgradable media device.
- supercoder 10y ago
  Or buy a smart TV and don't connect to wifi.
- nommm-nommm 10y ago
  Projectors are nice if you have a huge blank wall. My TV needs to go off to the side due to the layout of my living room, the fireplace is the focal point of the room. Plenty of other rooms the TV has the best viewing angles from a corner. They can't replace TV's in all situations. (I also prefer the picture quality of my plasma TV over a projector... But that's personal preference. Too bad plasma went the way of the dodo)
  - walterbell 10y ago
    In some cases, you can use a screen, even in a corner. But yes, projectors and TVs have different roles, even if one of them is a privacy/security risk.
deleted 10y ago
[deleted]
logicallee 10y ago
Remember that this kind of ransomware is a pyramid scheme: if you pay it, you're not really paying for your stuff back. You're paying to infect your friends and other people. Who financed the attack on your stuff? Anyone who payed the ransom previously. Never pay a ransom. Turn the request over to the government: the government literally exists to assure rule of law. If we were okay with a "might makes right" world, we wouldn't need government or the rule of law. The government literally exists so this stuff doesn't happen. If you finance it, you're a criminal and a terrorist, and you are paying for them to infect me. You are literally paying for cyber attacks. Not metaphorically but in the most direct possible terms. Don't do it. And if you're a criminal, don't develop it. I feel this is not being stated clearly enough these articles - the people developing it are obviously talented engineers: they could be using their skills constructively. It's important to make it very clear that what they're doing is wrong, and supporting them is wrong. This isn't an optional thing. They need to stop doing this, shut down their networks, and go do something constructive with their skills. It's people's duty to let them know this, and to report these things. It's a waste of everyone's time, especially theirs.
- tekromancr 10y ago
  I'm not sure how effective asking criminals not to crime is going to be.
  - logicallee 10y ago
    Why not? Asking men not to rape reduces rape. By the way it takes considerable intelligence and engineering skill to be technically able to hold for ransom a device at a distance. I am certain that these engineers are reading this comment. I can easily consider that they did not even consider the ethical side in evaluating the list of requirements and completing them. Articles which don't call their attention to this don't help. This isn't a nuisance: it's criminal behavior that needs to be reported to the government, and never, ever paid for or encouraged. My grandparent comment got downvoted heavily but I am keeping it. If you're a programmer who is doing this, stop.
    - 10y ago
izacus 10y ago
The fact that's completely impossible to buy a dumb TV anymore (the only company I know of that does something like that is Vizio, which isn't present in the EU market) is starting to become a huge problem - if you want a big screen in your home, it's impossible to not install the greatest malware vector and security risk in the house. Btw, from an application developers perspective it gets even better. For example Samsung locks down the application store updates after one year for each SmartTV models. So right now, SmartTV app developers aren't allowed to update ANY applications for 2015 and olders models of Samsung TVs. At all! When 2017 lineup comes in a month or so, all current Samsung SmartTVs will stop receiving app updates as well. So your applications WILL stop working and start rotting after a year or so after you buy their TV.
- mike-cardwell 10y ago
  A smart TV which you don't plug into the Internet, is the same as a dumb TV.
  - debaserab2 10y ago
    No it's not. Not when all basic TV functionality is handled through its operating system.
    - mike-cardwell 10y ago
      I have a Sony Bravia Smart TV. The only thing I use on it is the screen, the power button, and the volume control. Everything else is handled by the Internet connected Amazon Fire TV stick I plug into it. It is effectively a dumb TV and will not get infected by malware.
      - kfriede 10y ago
        Unless it can be infected using the stick as a proxy (though I haven't seen that as a possible vulnerability yet).
        10y ago
matt_wulfeck 10y ago
The UI on smart TVs is so jenk anyway. I can't stand to use it. I always leave it unplugged from the net and use an Apple TV.
- pdimitar 10y ago
  I do the same with my TV but it doesn't change the fact that its UI is as responsive as a website running on a calculator -- and it sometimes takes 90 seconds to even boot after I power it on. I wish we had a hardware switch on these TVs, something to alternate between an old screen-and-TV-mode-only, and a smart TV. Sigh.
- wernercd 10y ago
  We just recently got a Vizio and I'm actually not horrified by their setup. Large parts are useless - Yahoo Profile that can't be removed for example. The app selection is limited compared to some of the bigger companies. It sucks that the Remote Buttons are hard coded to Xumo and iHeartRadio - which I'll never use and would LOVE to switch those to say Plex and Pandora which I do use... But other than those issues, I've actually been rather impressed that most of the needs are met. Netflix, Pandora, Prime, Plex, Youtube. Logged into all the accounts and setup within an hour with shortcuts customized (except for on the remote and the Yahoo Profile that can't be removed). Granted... I think we will switch to ChromeCast because that works for all our other TVs and for consistency sake... but given how much hate there is towards Smart TVs, I expected to hate the "Vizio OS" (or whatever it's called)... and actually kinda like it.
- greggman 10y ago
  I recently got a Sony Bravia 4k hdr running Android TV. I would have preferred a dumb TV but I've been plesently surprised so far. it's got Chromecast built in which has been great at my last party (would like to know how to bridge that to the guest network so I don't have to let users on the main network) Kodi installed from the Play store and works pretty well. A few hd movie can't stream without skipping over the network from my nas but I can also plug in an hd directly to the TV as storage for Android. Has built in DVR just add hd which I did and have been using to grab a few things. Installed an Airplay app which seems to work. Have use it from both my phone and my Mac. Netflix and YouTube work fine. My original plan was to use it as a dumb TV and get a mac mini but Apple hadn't updated it in years. Thought about getting a NUC but so far it's doing everything I needed. Was able to turn off all the ads by going to every app and turning off notifications. It's supposedly going to get and Android 6 update soon so will see if still like it then.
xaduha 10y ago
Somewhat related, look up SamyGo.
mnglkhn2 10y ago
The case referenced in the story is about an old LG tv set that had the Android OS for its "smarts". The question is what is the app that the relative did download and from which app store? Also, this might explain why LG chose to switch to WebOS, where it could actually control how "smart" the TV could get.
21 10y ago
In the near future someone will hack your shower, hold it for ransom and demand $10 in bitcoin or else you'll have to go dirty and smelling to work. More seriously, this is bad news for bitcoin. Governments will move in and require tracking of all transactions.
- drvdevd 10y ago
  Aren't they all already tracked on the public ledger? If governments move in, it's my understanding that it would be at the points of currency exchange.
robert_tweed 10y ago
Personally, I'm wary of ideas like software engineers facing unlimited personal liability like hardware engineers, because computer science just hasn't advanced to a point where we can say with confidence that any non-trivial piece of code works correctly (or even define what that means). However, I do think there needs to be some serious financial penalties for companies like LG, Samsung, D-Link, etc., who ship flagrantly insecure firmware that in many cases is uneccessary, is almost never supported for anything like the realistic lifetime of the device, and where it is clear to anyone with industry expertise that they have demonstrated a negligent lack of basic competency. For example, back in 2007 it might have been acceptable to store passwords as salted MD5. Nowadays, not good enough. Any hardware made competently then might have used a salted MD5 password store. Fine. But really, patches should be provided for at leat 10 years and those patches should bring firmware into line with the current state of the art. Thus I think it would be reasonable to sue a hardware manufacturer for a device made in 2007, still in service in 2017, which cannot be updated to have better password security than salted MD5. It of course goes without saying that things like default passwords (admin:admin etc) should be considered outright unacceptable in any network-enabled consumer device. Obviously we can't hold device manufacturers liable forever, nor can we expect NSA-proof levels of security, but I think it is reasonable to hold all hardware to a standard of "basic competency" for at least 10 years from the date of manufacture. The standard warranty period of 1-2 years is not sufficient. There is at the moment a serious risk/reward imbalance where it makes financial sense to ship "features" (even if nobody asked for them) at the expense of security, because the subsequent issues are someone else's problem. This is bad for device owners and bad for society as a whole, since compromised devices are commonly used for DDOS attacks, sharing child porn, etc. If device manufacturers knew there were serious financial consequences and that all features must be kept secure for 10+ years, they would certainly be more interested in making things modular and reducing potential attack surface areas than they are now.
- pdimitar 10y ago
  I agree 100% -- but you outlined the problem yourself by using the phrase "suing the companies". Consumers cannot and will not do that. It takes time, it takes money, and a company can drag it on forever and just exhaust you financially or psychologically. IMO the justice system's rules on "citizen vs. company" needs an overhaul, badly, for quite a long time now. I should be able to call Samsung in court and have my interests protected in one week. Does this happen right now? No. I can't see any hope for the future in this regard. There's no real punishment for companies being sloppy. One might think the capitalistic market would auto-correct things by people flocking to competitors, right? But I find this to not be the case; as you and others in this thread have pointed out, it's becoming harder and harder to buy non-smart TVs. Every OEM seems to be in the same dirty bed with everybody else, and the poor security becomes more and more excusable by "but everybody else does it too!" with each passing day. And we as consumers practically have no choice. You want the best picture quality on the market? Sorry, it comes with a lot of software (requiring internet connection) that you never asked for and you won't ever need. Furthermore, governments are by default awfully incompetent to help with issues like these. Even if we assume zero company lobbyists, most governments simply have no idea what is the problem at all, let alone take any measures. I hope I am wrong, though. Sorry if this is too pessimistic but quite frankly, I can't see any reason for hope at this point.
noonespecial 10y ago
Its the same sickness as the "infotainment" systems in cars. Its obsolete the moment it leaves the factory floor and the device lasts for years. The screen should be the screen. It you want to make it smart, plug in a Fire Stick, Chromecast, Apple TV or roll your own with Kodi and a Raspi. This is getting stupid. Its to the point that I bought one of these(1) and neutered an older smart TV that we had by replacing its "motherboard" just so it would act as a simple screen. (1) http://www.ebay.com/itm/Universal-V29-LCD-Controller-Motherboard-Board-TV-VGA-HDMI-AV-TV-USB-Interface-/222133043154?hash=item33b8293fd2:g:Q34AAOSwepZXSmhd http://www.ebay.com/itm/Universal-V29-LCD-Controller-Motherb...
- StavrosK 10y ago
  Wait wait wait. Are all screen interfaces the same? You can just replace the motherboard of any brand TV and it will work? Do all panels use the same voltage/pins/protocol? That's huge, if so.
  - wernercd 10y ago
    edited because I misread the thread
    - StavrosK 10y ago
      Huh? I don't think you realize what either I or the GP are saying. I'm asking whether the LED/LCD panel on all TVs use the same protocol to drive the pixels, which is how it would be possible for the GP to replace his motherboard with a generic alternative.
      - wernercd 10y ago
        You're right... I think missed the last sentence. Ignore me :) Trapped inside because of blizzard.
        lsh 10y ago
        Well, you know what they say "all work and no play ..."
WalterBright 10y ago
Sounds like a "factory reset" button for the TVs is all that is really necessary.
cletus 10y ago
The solution here is pretty simple: just don't connect your "smart" TV to the Internet. Not only does this avoid malware/randomeare/becoming part of a botnet but it also avoids the stupid pop ups about "The terms and conditions [sobething you don't use, care about and probably didn't know existed] have changed. <OK|Cancel>". If you're using DVRs, STBs, etc you're getting the same effect. Connecting to the Internet gains you nothing.
throwaway2359 10y ago
Sorry if this is a really dumb question, but what exactly is the point of a TV? Is it for having a monolithic assemblage of computer monitor plus one-way modem that only works for certain data content streams? Do people get substantial price discounts by going the monolithic route rather than buy these devices as separate interconnecting functions that can be independently sourced for specific features and conveniently upgraded? What exactly is motivating people to buy a TV other than being susceptible to advertising? Obviously, I've never bought a TV hence asking this question. But I've had friends who buy them, and although I've inquired about their purchase decision making I've never received a reply other than "it was on sale last Black Friday."
- intopieces 10y ago
  >Is it for having a monolithic assemblage of computer monitor plus one-way modem that only works for certain data content streams? Yes. Most people do not care to assemble their own little batch of boxes and cables just to make television happen. Most people would rather purchase a unit that makes video play in the living room, because their lives are filled with other things to do.
nitrogen 10y ago
A question regarding what to do about this problem: https://news.ycombinator.com/item?id=13348211 https://news.ycombinator.com/item?id=13348211
Tempest1981 10y ago
> First, make sure your TV is always up to date. I always cringe when I see this "simple solution" because A) I know so many people who don't even know that updating their TV is a "thing", and B) eventually we'll have more devices than we can keep track of, each requiring weekly updates.

114 points by kogir 10y ago

acd 10y ago

Smart tv should have open boot loaders allowing open operating systems and then this would not be an issue. There should also be a http boot firmware recovery option. Open operating systems can receive security updates by the community long after the manufacturer has lost their interest in the device. Should it even be called a "Smart TV" if its hard to recover?

untog 10y ago
IMO, smart TVs shouldn't exist. You should buy a dumb TV then plug in whatever Chromecast, Roku, Amazon, Apple you want into it. Coupling the two together just means the software gets outdated long before the hardware does. Up until now I haven't really cared, since I ignore all the smart TV junk and use my device anyway. But if it's going to start getting ransomwared no matter what I do... just let me buy a dumb TV.
- macjohnmcc 10y ago
  We bought a Sharp Roku TV because of price and regret it. I don't care for a TV that has to boot up or have software updates. A dumb monitor even without a tv tuner would be better.
- angry-hacker 10y ago
  What stops you not connecting the device to network in the first place? Serious question, I haven't bought one yet but probably soon have, because there's no other choice.
  - izacus 10y ago
    Well, just like for many modern phone OSes (e.g. iOS for example in some cases), you're not able to finish the setup wizard and start using it without connecting it to the internet for inital activation.
    - teacup50 10y ago
      What manufacturers require internet activation? That's a non-starter for any product I purchase.
      - izacus 10y ago
        I've seen a single Samsung TV up until now, but it was a rather non-common model. Luckly (FOR NOW!) vast majority of TVs still work offline. In the future this may change - at this point some Samsungs already overlay their ads on volume change UI (and some other parts) to get additional revenue. With such incentives, I'm worried just how long you'll be able to buy a TV that can function offline.
- PaulHoule 10y ago
  It seems like an awful neat solution to me to plug the TV into the ethernet and there you go... If you look at low end TVs you'll find the "useful life" limited more by the hardware than by the software. If the hardware can't do it, for instance, no H.265 decoding for you.
  - izacus 10y ago
    Then again, pretty much all 5 year TVs or so will easily handle H.264 in their supported panel resolution. Which doesn't help you if your Netflix / YouTube app was never updated and can't connect to the service anymore. H.265 is generally only used for 4K content and 4K TVs carry decoders with them mostly.
- Animats 10y ago
  LG procedure from YouTube video to revert to factory defaults: Plug in. Press Settings + CH Dwn together, release. Select "Wipe data," then "Yes." Wait for "complete." Power cycle. It's not that it's hard, it's that it wasn't in the manual.
nothrabannosir 10y ago
> Smart tv should have open boot loaders allowing open operating systems and then this would not be an issue. There should also be a http boot firmware recovery option. Yes > Open operating systems can receive security updates by the community long after the manufacturer has lost their interest in the device. Yes > Should it even be called a "Smart TV" if its hard to recover? ...? Yes.
jaclaz 10y ago
There are some alternative firmware projects like samygo (for Samsung) and openlgtv (for LG): https://wiki.samygo.tv/index.php5?title=Main_Page https://wiki.samygo.tv/index.php5?title=Main_Page http://openlgtv.org.ru/wiki/index.php/Main_Page http://openlgtv.org.ru/wiki/index.php/Main_Page But they support AFAIK only a limited number of devices and also only some firmware versions (it seems like both Samsung and LG are attempting to close the doors).

walterbell 10y ago

Buy a short-throw projector and connect an easily upgradable media device.

supercoder 10y ago
Or buy a smart TV and don't connect to wifi.
nommm-nommm 10y ago
Projectors are nice if you have a huge blank wall. My TV needs to go off to the side due to the layout of my living room, the fireplace is the focal point of the room. Plenty of other rooms the TV has the best viewing angles from a corner. They can't replace TV's in all situations. (I also prefer the picture quality of my plasma TV over a projector... But that's personal preference. Too bad plasma went the way of the dodo)
- walterbell 10y ago
  In some cases, you can use a screen, even in a corner. But yes, projectors and TVs have different roles, even if one of them is a privacy/security risk.

deleted 10y ago

[deleted]

logicallee 10y ago

Remember that this kind of ransomware is a pyramid scheme: if you pay it, you're not really paying for your stuff back. You're paying to infect your friends and other people. Who financed the attack on your stuff? Anyone who payed the ransom previously. Never pay a ransom. Turn the request over to the government: the government literally exists to assure rule of law. If we were okay with a "might makes right" world, we wouldn't need government or the rule of law. The government literally exists so this stuff doesn't happen. If you finance it, you're a criminal and a terrorist, and you are paying for them to infect me. You are literally paying for cyber attacks. Not metaphorically but in the most direct possible terms. Don't do it. And if you're a criminal, don't develop it. I feel this is not being stated clearly enough these articles - the people developing it are obviously talented engineers: they could be using their skills constructively. It's important to make it very clear that what they're doing is wrong, and supporting them is wrong. This isn't an optional thing. They need to stop doing this, shut down their networks, and go do something constructive with their skills. It's people's duty to let them know this, and to report these things. It's a waste of everyone's time, especially theirs.

tekromancr 10y ago
I'm not sure how effective asking criminals not to crime is going to be.
- logicallee 10y ago
  Why not? Asking men not to rape reduces rape. By the way it takes considerable intelligence and engineering skill to be technically able to hold for ransom a device at a distance. I am certain that these engineers are reading this comment. I can easily consider that they did not even consider the ethical side in evaluating the list of requirements and completing them. Articles which don't call their attention to this don't help. This isn't a nuisance: it's criminal behavior that needs to be reported to the government, and never, ever paid for or encouraged. My grandparent comment got downvoted heavily but I am keeping it. If you're a programmer who is doing this, stop.
  - 10y ago

izacus 10y ago

The fact that's completely impossible to buy a dumb TV anymore (the only company I know of that does something like that is Vizio, which isn't present in the EU market) is starting to become a huge problem - if you want a big screen in your home, it's impossible to not install the greatest malware vector and security risk in the house. Btw, from an application developers perspective it gets even better. For example Samsung locks down the application store updates after one year for each SmartTV models. So right now, SmartTV app developers aren't allowed to update ANY applications for 2015 and olders models of Samsung TVs. At all! When 2017 lineup comes in a month or so, all current Samsung SmartTVs will stop receiving app updates as well. So your applications WILL stop working and start rotting after a year or so after you buy their TV.

mike-cardwell 10y ago
A smart TV which you don't plug into the Internet, is the same as a dumb TV.
- debaserab2 10y ago
  No it's not. Not when all basic TV functionality is handled through its operating system.
  - mike-cardwell 10y ago
    I have a Sony Bravia Smart TV. The only thing I use on it is the screen, the power button, and the volume control. Everything else is handled by the Internet connected Amazon Fire TV stick I plug into it. It is effectively a dumb TV and will not get infected by malware.
    - kfriede 10y ago
      Unless it can be infected using the stick as a proxy (though I haven't seen that as a possible vulnerability yet).
      - 10y ago

matt_wulfeck 10y ago

The UI on smart TVs is so jenk anyway. I can't stand to use it. I always leave it unplugged from the net and use an Apple TV.

pdimitar 10y ago
I do the same with my TV but it doesn't change the fact that its UI is as responsive as a website running on a calculator -- and it sometimes takes 90 seconds to even boot after I power it on. I wish we had a hardware switch on these TVs, something to alternate between an old screen-and-TV-mode-only, and a smart TV. Sigh.
wernercd 10y ago
We just recently got a Vizio and I'm actually not horrified by their setup. Large parts are useless - Yahoo Profile that can't be removed for example. The app selection is limited compared to some of the bigger companies. It sucks that the Remote Buttons are hard coded to Xumo and iHeartRadio - which I'll never use and would LOVE to switch those to say Plex and Pandora which I do use... But other than those issues, I've actually been rather impressed that most of the needs are met. Netflix, Pandora, Prime, Plex, Youtube. Logged into all the accounts and setup within an hour with shortcuts customized (except for on the remote and the Yahoo Profile that can't be removed). Granted... I think we will switch to ChromeCast because that works for all our other TVs and for consistency sake... but given how much hate there is towards Smart TVs, I expected to hate the "Vizio OS" (or whatever it's called)... and actually kinda like it.
greggman 10y ago
I recently got a Sony Bravia 4k hdr running Android TV. I would have preferred a dumb TV but I've been plesently surprised so far. it's got Chromecast built in which has been great at my last party (would like to know how to bridge that to the guest network so I don't have to let users on the main network) Kodi installed from the Play store and works pretty well. A few hd movie can't stream without skipping over the network from my nas but I can also plug in an hd directly to the TV as storage for Android. Has built in DVR just add hd which I did and have been using to grab a few things. Installed an Airplay app which seems to work. Have use it from both my phone and my Mac. Netflix and YouTube work fine. My original plan was to use it as a dumb TV and get a mac mini but Apple hadn't updated it in years. Thought about getting a NUC but so far it's doing everything I needed. Was able to turn off all the ads by going to every app and turning off notifications. It's supposedly going to get and Android 6 update soon so will see if still like it then.

xaduha 10y ago

Somewhat related, look up SamyGo.

mnglkhn2 10y ago

The case referenced in the story is about an old LG tv set that had the Android OS for its "smarts". The question is what is the app that the relative did download and from which app store? Also, this might explain why LG chose to switch to WebOS, where it could actually control how "smart" the TV could get.

21 10y ago

In the near future someone will hack your shower, hold it for ransom and demand $10 in bitcoin or else you'll have to go dirty and smelling to work. More seriously, this is bad news for bitcoin. Governments will move in and require tracking of all transactions.

drvdevd 10y ago
Aren't they all already tracked on the public ledger? If governments move in, it's my understanding that it would be at the points of currency exchange.

robert_tweed 10y ago

Personally, I'm wary of ideas like software engineers facing unlimited personal liability like hardware engineers, because computer science just hasn't advanced to a point where we can say with confidence that any non-trivial piece of code works correctly (or even define what that means). However, I do think there needs to be some serious financial penalties for companies like LG, Samsung, D-Link, etc., who ship flagrantly insecure firmware that in many cases is uneccessary, is almost never supported for anything like the realistic lifetime of the device, and where it is clear to anyone with industry expertise that they have demonstrated a negligent lack of basic competency. For example, back in 2007 it might have been acceptable to store passwords as salted MD5. Nowadays, not good enough. Any hardware made competently then might have used a salted MD5 password store. Fine. But really, patches should be provided for at leat 10 years and those patches should bring firmware into line with the current state of the art. Thus I think it would be reasonable to sue a hardware manufacturer for a device made in 2007, still in service in 2017, which cannot be updated to have better password security than salted MD5. It of course goes without saying that things like default passwords (admin:admin etc) should be considered outright unacceptable in any network-enabled consumer device. Obviously we can't hold device manufacturers liable forever, nor can we expect NSA-proof levels of security, but I think it is reasonable to hold all hardware to a standard of "basic competency" for at least 10 years from the date of manufacture. The standard warranty period of 1-2 years is not sufficient. There is at the moment a serious risk/reward imbalance where it makes financial sense to ship "features" (even if nobody asked for them) at the expense of security, because the subsequent issues are someone else's problem. This is bad for device owners and bad for society as a whole, since compromised devices are commonly used for DDOS attacks, sharing child porn, etc. If device manufacturers knew there were serious financial consequences and that all features must be kept secure for 10+ years, they would certainly be more interested in making things modular and reducing potential attack surface areas than they are now.

pdimitar 10y ago
I agree 100% -- but you outlined the problem yourself by using the phrase "suing the companies". Consumers cannot and will not do that. It takes time, it takes money, and a company can drag it on forever and just exhaust you financially or psychologically. IMO the justice system's rules on "citizen vs. company" needs an overhaul, badly, for quite a long time now. I should be able to call Samsung in court and have my interests protected in one week. Does this happen right now? No. I can't see any hope for the future in this regard. There's no real punishment for companies being sloppy. One might think the capitalistic market would auto-correct things by people flocking to competitors, right? But I find this to not be the case; as you and others in this thread have pointed out, it's becoming harder and harder to buy non-smart TVs. Every OEM seems to be in the same dirty bed with everybody else, and the poor security becomes more and more excusable by "but everybody else does it too!" with each passing day. And we as consumers practically have no choice. You want the best picture quality on the market? Sorry, it comes with a lot of software (requiring internet connection) that you never asked for and you won't ever need. Furthermore, governments are by default awfully incompetent to help with issues like these. Even if we assume zero company lobbyists, most governments simply have no idea what is the problem at all, let alone take any measures. I hope I am wrong, though. Sorry if this is too pessimistic but quite frankly, I can't see any reason for hope at this point.

noonespecial 10y ago

Its the same sickness as the "infotainment" systems in cars. Its obsolete the moment it leaves the factory floor and the device lasts for years. The screen should be the screen. It you want to make it smart, plug in a Fire Stick, Chromecast, Apple TV or roll your own with Kodi and a Raspi. This is getting stupid. Its to the point that I bought one of these(1) and neutered an older smart TV that we had by replacing its "motherboard" just so it would act as a simple screen. (1) http://www.ebay.com/itm/Universal-V29-LCD-Controller-Motherboard-Board-TV-VGA-HDMI-AV-TV-USB-Interface-/222133043154?hash=item33b8293fd2:g:Q34AAOSwepZXSmhd http://www.ebay.com/itm/Universal-V29-LCD-Controller-Motherb...

StavrosK 10y ago
Wait wait wait. Are all screen interfaces the same? You can just replace the motherboard of any brand TV and it will work? Do all panels use the same voltage/pins/protocol? That's huge, if so.
- wernercd 10y ago
  edited because I misread the thread
  - StavrosK 10y ago
    Huh? I don't think you realize what either I or the GP are saying. I'm asking whether the LED/LCD panel on all TVs use the same protocol to drive the pixels, which is how it would be possible for the GP to replace his motherboard with a generic alternative.
    - wernercd 10y ago
      You're right... I think missed the last sentence. Ignore me :) Trapped inside because of blizzard.
      - lsh 10y ago
        Well, you know what they say "all work and no play ..."

WalterBright 10y ago

Sounds like a "factory reset" button for the TVs is all that is really necessary.

cletus 10y ago

The solution here is pretty simple: just don't connect your "smart" TV to the Internet. Not only does this avoid malware/randomeare/becoming part of a botnet but it also avoids the stupid pop ups about "The terms and conditions [sobething you don't use, care about and probably didn't know existed] have changed. <OK|Cancel>". If you're using DVRs, STBs, etc you're getting the same effect. Connecting to the Internet gains you nothing.

throwaway2359 10y ago

Sorry if this is a really dumb question, but what exactly is the point of a TV? Is it for having a monolithic assemblage of computer monitor plus one-way modem that only works for certain data content streams? Do people get substantial price discounts by going the monolithic route rather than buy these devices as separate interconnecting functions that can be independently sourced for specific features and conveniently upgraded? What exactly is motivating people to buy a TV other than being susceptible to advertising? Obviously, I've never bought a TV hence asking this question. But I've had friends who buy them, and although I've inquired about their purchase decision making I've never received a reply other than "it was on sale last Black Friday."

intopieces 10y ago
>Is it for having a monolithic assemblage of computer monitor plus one-way modem that only works for certain data content streams? Yes. Most people do not care to assemble their own little batch of boxes and cables just to make television happen. Most people would rather purchase a unit that makes video play in the living room, because their lives are filled with other things to do.

nitrogen 10y ago

A question regarding what to do about this problem: https://news.ycombinator.com/item?id=13348211 https://news.ycombinator.com/item?id=13348211

Tempest1981 10y ago

> First, make sure your TV is always up to date. I always cringe when I see this "simple solution" because A) I know so many people who don't even know that updating their TV is a "thing", and B) eventually we'll have more devices than we can keep track of, each requiring weekly updates.